Possible CVE-2021-1675 Print Spooler Exploitation (PrintNightmare)

SigmaHQ Detections@sigmaHQ

•updated Sep 13, 2024•0•30

Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675, also known as PrintNightmare. The rule specifically looks for EventID 808 with ErrorCode 0x45A or 0x7e, combined with keywords indicating a plug-in module load failure and common DLL names used in PrintNightmare Proof-of-Concept exploits.